CVE-2024-3303

MediumCVSS 5.7/10Last modified Jun 17, 2026

Description

An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.6.5, starting from 17.7 prior to 17.7.4, and starting from 17.8 prior to 17.8.2, which allows an attacker to exfiltrate contents of a private issue using prompt injection.

Metrics

CVSS 3.1 5.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Affected software

VendorProductVersions
GitLabGitLab>= 16.0, < 17.6.5; >= 17.7, < 17.7.4; >= 17.8, < 17.8.2

References

Timeline

Published
Feb 13, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-330306.7Memory corruption while parsing IPC frequency table parameters for LPLH that has size greater than expected size.CVE-2024-330316.7Memory corruption while processing the update SIM PB records request.CVE-2024-330326.7Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it.CVE-2024-330337.8Memory corruption while processing IOCTL calls to unmap the buffers.CVE-2024-330347.8Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffersCVE-2024-330358.4Memory corruption while calculating total metadata size when a very high reserved size is requested by gralloc clients.CVE-2024-330366.7Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing wCVE-2024-330376.1Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received frCVE-2024-330387.8Memory corruption while passing untrusted/corrupted pointers from DSP to EVA.CVE-2024-330396.7Memory corruption when PAL client calls PAL service APIs by passing a random value as handle and the handle is not validated by the service.CVE-2024-330407.0Memory corruption while invoking redundant release command to release one buffer from user space as race condition can occur in kernel spaceCVE-2024-330417.8Memory corruption when input parameter validation for number of fences is missing for fence frame IOCTL calls,